36574 matches found
@hyorman/copilot-proxy-cli (>=1.0.4, <=1.0.5), @senoldogann/code-companion (>=0.1.38, <=0.1.56) +8 more potentially affected by CVE-2026-45033 via @github/copilot (>=1.0.12, <=1.0.40)
@github/copilot NPM version =1.0.12, =1.0.4, =0.1.38, =0.12.6, =0.8.5, =0.6.0, =0.6.1, =0.6.8, =1.0.0, =2.0.0 - @vibe-forge/client 1.0.0 - bitbucket-copilot-pr-review 0.5.1 Source cves: CVE-2026-45033 Source advisory: SNYK:JS-GITHUBCOPILOT-16642141...
@hyorman/copilot-proxy-cli (>=1.0.4, <=1.0.5), @senoldogann/code-companion (>=0.1.38, <=0.1.56) +8 more potentially affected by CVE-2026-45033 via @github/copilot (>=1.0.12, <=1.0.40)
@github/copilot NPM version =1.0.12, =1.0.4, =0.1.38, =0.12.6, =0.8.5, =0.6.0, =0.6.1, =0.6.8, =1.0.0, =2.0.0 - @vibe-forge/client 1.0.0 - bitbucket-copilot-pr-review 0.5.1 Source cves: CVE-2026-45033 Source advisory: GHSA-9CCR-R5HG-74GF...
Incorrect Behavior Order
Overview @github/copilot is a GitHub Copilot CLI brings the power of Copilot coding agent directly to your terminal. Affected versions of this package are vulnerable to Incorrect Behavior Order that enables code execution via the core.fsmonitor configuration key in a nested bare git repository. A...
CVE-2026-46510
creationtimestamp| type| source ---|---|--- 2026-05-11 16:10:55+00:00| published-proof-of-concept| https://github.com/kaspernj/form-data-objectizer/security/advisories/GHSA-m2hg-wjq3-28wq 2026-05-29 15:00:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmyshpa7fd2v...
GuardDog has a blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration
Summary The programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an attacker who can influence the scanned repository URL to trigger SSRF and...
GHSA-587R-MC96-6F2P GuardDog has a blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration
Summary The programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an attacker who can influence the scanned repository URL to trigger SSRF and...
CVE-2026-45548
creationtimestamp| type| source ---|---|--- 2026-05-11 10:41:34+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-rpj4-7x2v-wjrf...
PT-2026-39677
Name of the Vulnerable Software and Affected Versions GuardDog versions 1.0.0 through 2.9.0 Description The programmatic remote project scanning path in the ProjectScanner.scan remote function rewrites attacker-controlled repository URLs using blind string replacement before sending the caller's...
PT-2026-39901
Name of the Vulnerable Software and Affected Versions GitHub Copilot CLI versions prior to 1.0.43 Description An issue exists where a malicious bare git repository nested inside a project directory can lead to arbitrary code execution when the agent performs git operations. By exploiting git's...
Comment and Control: Hijacking Agentic Workflows Via Context-Grounded Evolution
Automation platforms such as GitHub Actions and n8n are increasingly adopting so-called agentic workflows, which integrate Large Language Model LLM agents for tasks such as code review and data synchronization. While bringing convenience for developers, this integration exposes a new risk: An...
CVE-2026-36980
creationtimestamp| type| source ---|---|--- 2026-05-10 21:00:04+00:00| seen| https://t.me/GithubRedTeam/83710 2026-05-10 23:00:14+00:00| seen| Telegram/4E6rSRxwI8rbj53U5V5E-Exh2Wmlv2Bw5SwE4GoCs4Wb5U 2026-05-11 03:00:06+00:00| seen| Telegram/mGI2CRHqQCjyvA6ju1XF5IWDLp0GZA5xrkAMw9kytXRmaE...
CVE-2026-45395
creationtimestamp| type| source ---|---|--- 2026-05-10 19:34:01+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-p4fx-23fq-jfg6...
CVE-2026-45387
creationtimestamp| type| source ---|---|--- 2026-05-10 19:31:55+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-h2cw-7qw9-56xr...
CVE-2026-45385
creationtimestamp| type| source ---|---|--- 2026-05-10 19:29:59+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-wwhq-cx22-f7vv...
CVE-2026-45375
creationtimestamp| type| source ---|---|--- 2026-05-10 15:32:12+00:00| published-proof-of-concept| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-27qc-m5gf-jv5r 2026-06-25 01:39:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp3cbffawf2p...
CVE-2026-45373
creationtimestamp| type| source ---|---|--- 2026-05-10 07:52:37+00:00| published-proof-of-concept| https://github.com/Hmbown/DeepSeek-TUI/security/advisories/GHSA-88gh-2526-gfrr...
GHSA-R48C-V28R-PF6V vulnerabilities
Vulnerabilities for packages: goreleaser...
GHSA-RQV2-M695-F8J4 vulnerabilities
Vulnerabilities for packages: goreleaser...
CVE-2024-25624
creationtimestamp| type| source ---|---|--- 2026-05-10 02:48:32+00:00| seen| https://gist.github.com/khoindq/bded28fd1242788522ce29d279b9d883 2026-05-10 03:58:34+00:00| seen| https://gist.github.com/khoindq/f145db4952e1aa3644b83c964afbf97a...